Vulnerability of Selfish Routing to Attacks: Game ... - Semantic Scholar

Proceedings of the World Congress on Engineering 2010 Vol I WCE 2010, June 30 - July 2, 2010, London, U.K.

Vulnerability of Selfish Routing to Attacks: Game-theoretic Models and Initial Results D. Genin, V. Marbukh, and A. Nakassis

Abstract—This paper reports on work in progress on assessing and mitigating selfish routing vulnerability to strategic attacks. We explain mechanisms leading to this vulnerability, propose the corresponding game-theoretic model, solve this model for some particular case, and discuss implications of the vulnerability phenomenon. Our approach extends the well established research agenda on selfish routing by incorporating attacker(s) as separate agent(s) in the corresponding game. While each user makes its routing decision in attempt to minimize its transportation cost, the attacker(s) manipulate the link costs for the purpose of increasing the aggregate transportation cost to all or some users, e.g., by damaging the physical infrastructure or inserting malicious traffic as in Denial of Service (DoS) attack. Our initial results demonstrate that even “weak” attacker is capable of inflicting a serious damage measured by increase in the price of anarchy as compared to the case without attacker. Presence of attacker(s) can make Braess’s paradox more pronounced. These initial results demonstrate importance of further research on the effect of the adversarial actions on selfish routing and a possibility of mitigating of this effect. Index Terms—Selfish routing, attacks, game-theoretic model, price of anarchy.

I. INTRODUCTION An emergent trend in networking attempts to resolve inefficiencies of network defined routing [1]-[2] by shifting responsibility for routing from the network to end users, e.g., by using source routing [3] or overlay routing [4]. Despite the fact that user-defined routing is much better than conventional network-defined routing in addressing specific user concerns, the downside may be the inherent selfish nature of user-centric routing, where each user attempts to optimize its own performance objective without concern for the overall network performance. This selfishness may lead to loss in overall network performance. The comparative performance of these two routing schemes, network-defined and user-defined, is currently an active area of research. While performance limits of network-defined routing can be assessed by using optimization techniques, performance of selfish routing is typically identified with a Nash equilibrium in the Manuscript received March 5, 2010. This work was supported in part by the U.S. Department of Commerce under Cyber-security program. Authors are with the National Institute of Standards and Technology, Gaithersburg, MD 80305 USA (corresponding author V. Marbukh: 301-975-2235; fax: 301-975-3553; e-mail: [email protected]). D. Genin and A. Nakassis are with the Advanced Networking Division (e-mails: [email protected] and [email protected]). V. Marbukh is with the Mathematics and Computer Science Division.

ISBN: 978-988-17012-9-9 ISSN: 2078-0958 (Print); ISSN: 2078-0966 (Online)

corresponding non-cooperative game-theoretic model. Due to the typical multiplicity of Nash equilibria, loss in overall network performance resulting from user selfishness is defined by the price of anarchy: the worst-case ratio of the aggregate cost of selfish and socially optimal routing [5]. This definition assumes that network defined socially optimal routing minimizes the aggregate routing cost, and thus the price of anarchy always exceeds or equal one. Note that the route costs may represent actual payments for traffic delivery or they may instead characterize route quality with respect to delays, reliability, etc. Theoretical and simulation results [6]-[7] suggest that despite the fact that the price of anarchy may be high and even unbounded, in practical situations performance deterioration due to user selfishness is within tolerable limits. Selfish user behavior can also lead to counterintuitive behavior known as the Braess paradox [8]: increasing the number of routing choices by adding more links to the network increases the aggregate transportation cost. This paper attempts to gain an initial understanding of the effect of adversarial presence, e.g., attackers, on the performance of selfish routing. To this end we extend the conventional framework for performance evaluation of selfish routing by including the possibility of attacker(s) capable of manipulating the route costs in an attempt to maximize the aggregate transportation cost for all or some users, e.g., by damaging the physical infrastructure in transportation networks, inserting malicious traffic in a Denial of Service (DoS) attack on communication networks, or jamming in wireless networks. We propose an extended game-theoretic model, where strategic attacker(s) are modeled as separate agent(s) with limits on ability to manipulate route costs reflecting attacker power. Quite surprisingly, our results indicate that even a weak attacker can inflict a significant damage on network performance. The reason for this disproportional effect is that an adversarial presence creates incentive for selfish users to avoid being attacked by making other users more appealing targets for attacker(s). This incentive may create a positive feedback eliminating the socially optimal equilibrium and driving selfish users to a very inefficient equilibrium. The paper is organized as follows. Section II informally demonstrates how selfish user behavior in presence of even a weak adversary may lead to inefficient system equilibrium and Braess’s paradox. Section III offers a game-theoretic performance model for selfish routing under attack, and introduces the corresponding generalized price of anarchy. Section IV solves this model in a particular case of several sources transmitting to a common destination either directly or via another source. Finally, Conclusion summarizes our results and outlines directions of future research.

WCE 2010

Proceedings of the World Congress on Engineering 2010 Vol I WCE 2010, June 30 - July 2, 2010, London, U.K.

II. MOTIVATION: INFORMAL CASE STUDY Figure 1 shows a simple network with two sources s1 and

s 2 sending traffic at rates λ1 and λ2 respectively to the common destination s0 .

portion ξ of traffic on either direct route r1 or r2 where route selection is intended to maximize the total amount of affected traffic before reaching the destination. Since transit routes are “more expensive” than direct routes for both sources, the socially optimal routing for both sources si is to send the entire traffic over the direct links ri and do not use link r at all regardless of attacker presence. In this case each source s1 and s 2 incurs transportation cost of cλ while

having portion (ξ 2)λ of its traffic disrupted due to symmetry. However, selfishness will drive sources away from this social optimum as follows. Source s1 can improve its

position by shifting a very small portion ε → 0 of its traffic from the direct route r1 to bypass route (r , r2 ) and thus making route r2 more appealing target for attack than route

Figure 1. Motivational example Sending traffic over a direct route ri , i = 1,2 connecting source si to the destination is associated with cost ci

≥0

per unit of rate. Sending traffic over the bi-directional route r connecting sources s1 and s 2 is associated with cost

d ≥ 0 per unit of rate. The transmission cost over a route is

additive with respect to all the links comprising the route. We assume that an attacker can disrupt a certain portion ξ of traffic on either direct route r1 or r2 , resulting in a certain penalty for the sources affected by the disruption, e.g., due to disrupted traffic. Consider two scenarios. In the first scenario sources s1 and s 2 are not directly connected. i.e., route

r does not

exist. In this scenario each source si can send traffic to the common destination s0 only over a single direct route ri ,

i = 1,2 . A weak attacker can destroy a small portion ξ of this direct traffic, but the negative effect on the network performance, which is proportional to ξ , will be small. In the second scenario, sources s1 and s 2 are directly connected by a bi-directional route r and have a choice to split their traffic between direct route ri and the bypass route

(r , r3−i ) , i = 1,2 . In the rest of this Section we informally

demonstrate that this ability to choose increases the routing cost, which is reminiscent of the Braess paradox. For simplicity we demonstrate this possibility in a symmetric case when sources si transmit at the same rate:

λi = λ , both direct routes ri , i = 1,2 have the same costs: ci 0 = c0 , i = 1,2 , and a strategic attacker disrupts a certain ISBN: 978-988-17012-9-9 ISSN: 2078-0958 (Print); ISSN: 2078-0966 (Online)

r1 . Indeed after this shift, route r2 will be carrying load (1 + ε )λ while route r1 will be carrying load (1 − ε )λ . As a result of this shift, source s1 reduces the portion of its disrupted traffic by a finite amount (1 − ε )(ξ 2) = O (1) at the cost of very small increase ελc in the transportation cost as ε → 0 . By symmetry, source s 2 has incentive to shift a very small portion ε → 0 of its traffic from the direct route r2 to bypass route (r , r1 ) . As both selfish sources s1 and s 2 attempt to improve their positions by shifting portions of

their traffic from direct to bypass routes, they will likely to move away from socially optimal equilibrium towards competitive equilibrium where both sources split their traffic equally between direct and bypass routes. This competitive equilibrium is less efficient than the socially optimal equilibrium with both sources using only direct routes. Indeed, due to the symmetry, the portion of disrupted traffic for each source ξ 2 is the same in both equilibria. However, while the socially optimal transportation cost is 2cλ , the competitive equilibrium has higher transportation cost of (2c + d )λ . Thus, a surprising conclusion is that even a very “weak”, meaning ξ → 0 , adversary can significantly reduce performance of selfish routing. It is instructive to look at this phenomenon as an increase in the transportation cost with increase in the number routing choices for selfish users. When only direct routes ri , i = 1,2

are available, an adversarial presence does not affect the routing cost. However, adding more routing possibilities for traffic delivery by adding route r directly connecting sources s1 and s 2 , results in an increase the transportation

cost from 2cλ to (2c + d )λ . This phenomenon is very similar to the Braess paradox [8]. However, since in our simple network without adversary the transportation cost is not affected by the presence of route r , the inefficiency of selfish routing is entirely due to adversarial presence. The purpose of this paper is to propose a formal framework for addressing these issues for general topology networks.

WCE 2010

Proceedings of the World Congress on Engineering 2010 Vol I WCE 2010, June 30 - July 2, 2010, London, U.K. III. MINIMUM-COST ROUTING This Section formally describes minimum cost routing, identifies possible exogenous reasons for link cost uncertainty, and discusses possible approaches to minimum cost route selection under uncertain link costs. A. Known Link Costs Consider a network with set of nodes N and set of links L . Users ( s, n) attempt to send traffic from node s ∈ N to

λsn

node n ∈ N \ s at fixed rate

λr

flows of rates

by splitting its traffic into

over feasible routes r ∈ Rsn :

λsn =

λ

r

(1)

r∈Rsn

The link l aggregate load is the sum of rates of all flows traversing this link:

μl =

λ

r :l∈r

(2)

r

Each user sending traffic over link l at rate λ incurs cost λcl ( μ l ) , and the cost of transmission over a route is the sum of the costs of transmissions over all links comprising this route. Thus, the transmission cost for user ( s, n) over route

r ∈ Rsn is   f r ( λ ) = λ r  cl   λ r ′  l∈r  r ′:l∈r ′  and the total cost to user ( s, n) is

(3)

(5)

where the aggregate cost is

  F ( λ ) =   λ r  cl   λ r ′  ( s , n ) r∈Rsn l∈r  r ′:l∈r ′ 

(6)

explicitly: the optimal route for user ( s, n) is

r = arg min  cl r∈Rsn

F

(7)

l∈r

= λsn min  cl r∈Rsn

l∈r

and the total cost for all users is

ISBN: 978-988-17012-9-9 ISSN: 2078-0958 (Print); ISSN: 2078-0966 (Online)

r∈Rsn

(9)

l∈r

routing processes [10]. In the case of QoS routing, the cost of a route

r reflects the expected level of the QoS provided to a request carried on this route. For example, cl may represent the expected delay, packet loss or available bandwidth on link l . Typically, link costs depend not only on the user routing decisions affecting link loads (2), but also on some exogenous parameter(s), which are often not known precisely. Uncertainty in the exogenous parameters creates uncertainty in the link costs making minimum cost route selection dependent on the nature of uncertainty. In the case of statistical uncertainty it is natural to minimize the average route cost. In this paper we are concerned with adversarial uncertainty created by attacker(s). In this case it is natural to base route selection on a worst-case route cost minimization. In the rest of this Subsection we consider some examples leading to link l ∈ L cost of the form where

μl

and convex in

μl ≥ 0 .

Further in the paper we consider a

particular case of link costs (10) with cl ( μ l ) = cl and

bl ( μ l ) = bl being link load independent. In this case link costs (10) take the following form

f l ( μ l η l ) = cl + η l

(11)

where η l = bl ξ l ≥ 0 is an exogenous parameter. In the case when a small portion

ξl

of traffic traversing

link l can be disrupted, user ( s, n) ’s aggregate cost (4) takes the following form:



 λ  b r

r∈Rsn

l∈r





λ 

ξ + cl 

sn l

where parameter bsn quantifies user

r ′:l∈r ′

r′

  

(12)

( s, n) sensitivity to

traffic disruption. In the case when all users have the same sensitivity to the traffic disruption, e.g., parameters bsn = b do not depend on ( s, n) , aggregate user ( s, n) cost (12) can be rewritten as follows:



 λ  f   λ r

r∈Rsn

l

l∈r

r ′:l∈r ′



r′

ξ 

(13)

where link l cost is

f l ( μ l ξ l ) = cl ( μ l ) + bξ l (8)

(10)

ξ l ≥ 0 is an exogenous bl ( μ l ) are increasing

is link l aggregate load,

Fsn (λ ξ ) =

the corresponding minimal user ( s, n) cost is min sn

min  cl

A. Unknown Link Costs Cost based strategies naturally arise as a result of optimization of the network performance [9] or incorporating Quality of Service ( QoS ) requirements into admission and

Fsn (λ ξ ) =

and minimization is subject to constraints (1). Due to our assumptions, optimization problem (1), (5)-(6) is convex, and thus has unique computationally tractable solution. In a particular case of load-independent link costs cl ( μ l ) = cl the socially optimal routing can be identified * sn

sn

parameter, functions cl ( μ l ) and

Socially optimal load allocation minimizes the aggregate cost for all users: ( λr ≥ 0 )

λ

( s,n)

f l ( μ l ξ l ) = cl ( μ l ) + bl ( μ l )ξ l

  (4) Fsn (λ ) =  λr  cl   λr ′  r∈Rsn l∈r  r ′:l∈r ′  where the vector λ = (λr ) characterizes flow rates on all feasible routes r in the network. We assume link cost cl ( μ l ) to be increasing and either linear or convex in link load μ l ≥ 0 for all links l ∈ L . F min = F (λopt ) = min F (λ )

F min =

(14)

User cost (13) has the same form as cost (4), but with modified link l costs (14), which now depend on the exogenous parameters

ξl .

In another example link costs are

WCE 2010

Proceedings of the World Congress on Engineering 2010 Vol I WCE 2010, June 30 - July 2, 2010, London, U.K. associated with delays, and a Denial of Service (DoS) attacker inserts malicious load ξ l on link l . In this case the modified link

l cost becomes f l ( μ l γ l ) = cl ( μ l ) + bl ( μ l )ξ l

where

(15)

bl ( μ l ) = [dcl ( μ ) dμ ]μ = μ l .

Further in the paper we assume link costs (15), aggregate user cost (13), and the aggregate cost for all users

F (λ ξ ) =





  λ  f   λ

( s , n ) r∈Rsn

r

l

l∈r

r ′:l∈r ′

r′

ξ

(16)



represents the best user ( s, n) response to other user load allocations

λ− (sn )

A. Load-dependent Link Costs Consider an adversarial uncertainty when vector ξ ∈ Ξ is controlled by an adversary who attempts to maximize the total cost for all users ( ):

ξ * (λ ) = arg max F (λ ξ )

(17)

ξ ∈Ξ

ξ * (λ ) represents the best attacker response to load allocation λ . We consider two scenarios for load allocation

Vector

against adversarial uncertainty: socially optimal and competitive. In a socially optimal scenario, given attacker strategy ξ ∈ Ξ , the social planner allocates all user loads in an

λ (ξ ) = arg min F (λ ξ )

where minimization is subject to constraints (1) and λr ≥ 0 . Load allocation (18) represents the best response by a social planner to attacker strategy ξ ∈ Ξ . It is natural to view (17)-(18) as best responses in a two-player: social planner and attacker, zero-sum game, where the social planner selects load allocation (18) in an attempt to minimize the aggregate routing cost while the attacker selects “attack vector” (17) in an attempt to maximize this cost. The value of max

this game Fmin quantifies the equilibrium aggregate cost when both players act to the best of their abilities. In a competitive scenario each selfish user ( s, n) allocates its own load

λ( sn ) = {λr :  λr = λns , λr ≥ 0, r ∈ Rsn }

in

an

attempt to minimize its cost in adversarial environment (17):

λ*( sn ) (λ− ( sn ) ) = arg min Fsn [λ ξ * (λ )] λ( sn )

(19)

λ− (sn ) characterizes load allocations by all users except user ( s, n) . User ( s, n) ’s load allocation (19) where vector

ISBN: 978-988-17012-9-9 ISSN: 2078-0958 (Print); ISSN: 2078-0966 (Online)

game

with

*

max γ = Fˆ** Fmin

(20)

characterizes loss in the aggregate performance due to user selfishness. It is easy to see that γ ≥ 1 since coordinated user strategy can better counteract an adversarial action. The novelty of our approach is its ability to quantify the loss in the aggregate performance due to user selfishness under attack as a function of the attacker “power” represented by the set of feasible attacker strategies Ξ : γ = γ (Ξ) (21) Note that the typical discontinuity of the best responses (17)-(19) makes conventional results about existence and uniqueness of the game equilibrium non-applicable for games proposed in this Subsection for socially optimal and selfish load allocations under adversarial uncertainty. Consider, as an example, a case of load-unaware link costs (11) and assume that set of feasible adversarial actions γ = γ (Ξ) is

{

}

Ξ = ξ l : l al ξ l ≤ η , ξ l ≥ 0, l ∈ L

(22)

with some al > 0 . In this case the optimal adversarial response (17) is to concentrate “the attack”:

η a ξ l* (λ ) =  l

(18)

λ

Stackelberg

Let Fˆ* be the maximum aggregate cost over all Nash equilibria in this game. The price of anarchy [5]-[6]

attempt to minimize the aggregate cost to all users: *

the

non-cooperative selfish users being leaders as they simultaneously allocate their loads in attempt to minimize their routing cost and an attacker being a follower who manipulates link costs in an attempt to maximize the aggregate routing cost to all users. Generally, this game may have multiple Nash equilibria with different aggregate routing costs.

IV. ROUTING UNDER ADVERSARIAL UNCERTAINTY This Section proposes game-theoretic models for socially optimal and selfish load allocation under attack, which is interpreted as adversarial uncertainty. In a general case of load-dependent link costs, considered in Subsection A, the agents have continuous sets of strategies and agent’s best responses are discontinuous. Subsection B considers the simpler case of load-independent link costs, when the corresponding games have finite sets of strategies.

in

on a link:

 0

if

l = l*

otherwise

l * (λ ) = arg max(bl al )  λr l ∈L

(23)

(24)

r :l∈r

where the impact is maximal. In a situation of several such “highest impact” links, the attacker is indifferent with respect to distributing its efforts among these links. B. Load-independent Link Costs Consider the case of load-independent link costs (11), and assume that each user ( s, n) chooses a single feasible route

r ∈ Rsn for transmitting its entire flow of rate λsn , while the attacker chooses a single link l ∈ L to attack by raising its cost from cl to cl + h , where h > 0 . It is convenient to characterize feasible pure strategies of the attacker by the binary variables: δ l = 1 if link l is attacked, and δ l = 0

( s, n) ’s transportation cost is Φ sn (r δ ) = λrsn  (cl + hδ l )  λij

otherwise. Thus, user

l∈rsn

(25)

( ij ):l∈rij

and the total transportation cost for all users is

WCE 2010

Proceedings of the World Congress on Engineering 2010 Vol I WCE 2010, June 30 - July 2, 2010, London, U.K.

Φ(r δ ) =

Φ

( s,n)

sn

(r δ )

(26)

where vector r = ( rsn ) characterizes route selections by all users, and vector

δ = (δ l )

characterizes attacker strategy.

Again, we consider two scenarios for load allocation in an adversarial environment: socially optimal and competitive. In both scenarios, given route selections by all users r = (rsn ) , the attacker selects a link to attack in an attempt to maximize the aggregate cost (26):

δ * (r ) = arg max Φ (r δ )

(27)

δ

The socially optimal scenario [11]-[13] is modeled as a zero-sum game of social planner and attacker, where for a given attacker strategy δ the social planner assigns routes to all users r = ( rsn ) in attempt to minimize the aggregate cost for all users: *

r (δ ) = arg min Φ (r δ )

(28)

r

The competitive scenario is modeled as a Stackelberg game with non-cooperative users being the leaders and the attacker being the follower. All users ( s, n) simultaneously select their routes

rsn* in attempts to minimize their own costs (25):

rsn* (r− ( sn ) ) = arg min Φ sn [r δ * (r )] , rsn

assuming

r−( sn ) = {rkm

attacker

strategy : (k , m) ≠ ( s, n)} .

(27),

(29) where

where Φ

max min

(30)

is the total user cost in the unique socially

ˆ * is the total user cost in the optimal equilibrium, and Φ worst-case competitive equilibrium. Note that performance of a mixed Nash equilibrium is characterized by the corresponding average cost. Consider price of anarchy (30) as a function of the power of attacker h ≥ 0 : γ = γ (h) . Apparently, in absence of an *

attacker the price of anarchy

γ (h) h = 0 = 1 , i.e., there is no

loss in performance due to user selfishness, since selfish users will choose socially optimal minimum cost routes. The Braess paradox refers to a counterintuitive situation when providing more choices to the selfish users by adding links to the network increases the total transportation cost.

ISBN: 978-988-17012-9-9 ISSN: 2078-0958 (Print); ISSN: 2078-0966 (Online)

occurrence of the Braess paradox even in a case of load-independent link costs. V. EXAMPLE Subsection A describes the example network and discusses the corresponding equilibria, price of anarchy and Braess paradox. Subsection B briefly outlines the derivation of the Nash equilibria for the example network. A. Price of Anarchy and Braess Paradox Consider a network comprised of sources s ∈ {1,.., S } transporting traffic to a common destination at rate

λs .

Each

s ∈ {1,.., S} can either use a direct route to the destination rs at cost of c s > 0 per unit of rate, or use any source

route rsn to the destination via any one other source

n ∈ {1,.., S } \ s at the cost of d sn + cn per unit rate, where d sn > 0 is a transportation cost from source s to source n . In this paper, due to space limitations, we consider the symmetric case when all users s ∈ {1,.., S } have the same transmission rates

Since both scenarios are modeled as games with finite sets of strategies, each of these games always has at least one Nash equilibrium. These equilibria may be either pure, e.g., specify a feasible route for each source and a link to attack, or mixed, e.g., a probability distribution on sets of feasible routes and links to attack. It is natural to view a mixed routing strategy as the corresponding load split among feasible routes, and a mixed attacker strategy as the corresponding splitting of the attacker efforts among different links. This interpretation provides a link between the game-theoretic formulation with finite set of strategies in this Subsection and the game-theoretic formulation with continuous sets of strategies in the previous Subsection. The price of anarchy consistent with definition (20) is

ˆ ** Φ max γ =Φ min ≥ 1 ,

Apparently, in absence of an attacker: h = 0 , the Braess paradox cannot occur. Informal arguments of Section II confirmed by formal analysis in the next Section of the paper demonstrate that the presence of an attacker, i.e., h > 0 may lead to loss in routing performance, i.e., γ ( h) > 1 , and

λs = λ

and direct transportation costs:

cs = c . We assume that transportation costs between any two sources

and

n ∈ {1,.., S} \ s are the same: d sn = d .

We also assume that attacker can raise transportation cost on one of S direct routes rs from c to c + h . Due to the symmetry, the socially optimal routing transports all traffic over direct links while the attacker attacks direct links equiprobably. The corresponding total aggregate transportation cost is

Φ max min ( h) = ( Sc + h)λ

(31) For simplicity we only consider the game-theoretic model introduced in Subsection IVB with a finite set of strategies. One can verify that while in socially optimal equilibrium users transport their traffic over direct routes, for h > 0 the competitive equilibrium exists, where each selfish user equally splits its traffic among all S feasible routes, which include one direct route and S − 1 bypass routes via other users. Formal arguments supporting this statement are briefly outlined in the next Subsection. In the rest of this Subsection we discuss the corresponding price of anarchy and a Braess paradox as links directly connecting different sources are added. In is easy to verify that the total transportation cost in the described above competitive equilibrium is

[ Sc + ( S − 1)d + h]λ if Φ ** =  Scλ if 

h>0 h=0

(32)

and the corresponding price of anarchy, shown in Figure 2, is

WCE 2010

Proceedings of the World Congress on Engineering 2010 Vol I WCE 2010, June 30 - July 2, 2010, London, U.K.

 ( S − 1)d  γ (h) = 1 + Sc + h  1 *

if

h>0

if

h=0

In the case (33)

α =β

route r1 carries the same load as other

direct routes rs , s ∈ {2,.., S } . Thus, the attacker will split its efforts among all direct routes rs , s ∈ {1,.., S } with probability 1 S raising the average cost of each direct route by h S . The average transportation cost for source s = 1 in this case is

 

φ1 (α β ) = cα +  c + d +

h  (1 − α ) S −1 

(37)

Since source s = 1 will attempt to minimize its cost (37) over α ∈ [0,1] , it is natural to identify Nash equilibria of the corresponding game with solution to equation β = arg min φ1 (α , β ) (38) α ∈[ 0 ,1]

VI. CONCLUSION Figure 2. Price of anarchy The price of anarchy

γ

γ

vs. attacker power h .

jumps from 1 for h = 0 to

1d (34) Sc as h becomes positive. Then, as h increases, the price of  

γ max = 1 + 1 − 

anarchy monotonically decreases approaching 1 due to ability of a powerful attacker to overwhelm any defense. The price of anarchy (33) also quantifies the severity of the Braess paradox as the network in question is expanded from one with only direct routes to include links directly connecting different sources.

This paper proposes a research agenda on the effect of adversarial presence measured by the price of anarchy. Initial models and results suggest practical importance as well as theoretical challenges of this research. For example, a possibility of reducing of the price of anarchy while preserving the distributed nature of resource allocation is an important question to answer. ACKNOWLEDGMENT Authors thank Dr. R. Boisvert for careful reading of the paper and numerous useful suggestions. REFERENCES [1]

B. Outline of Nash Equilibrium Derivation Let us assume that some source, say source s = 1 ,

α ∈ [0,1] and each probabilities (1 − α ) ( S − 1) .

chooses direct route r1 with probability of S − 1 transit routes with

s = 2,.., S choose direct route with probability β ≥ 0 and each of S − 1 transit routes with probabilities (1 − β ) ( S − 1) . The cost per unit of rate for the source depends on either α > β , α < β , or α = β . In the case α > β route r1 carries more load than other direct routes rs , s ∈ {2,.., S } . Thus, route r1 will be attacked making the source s = 1 transportation cost φ1 (α β ) = (c + h)α + (c + d )(1 − α ) . (35)

Sources

In a case

α